⚡ 10-second version
Drop the PDF into tooladda.online/pdf-password-protector.html, set a password, download the encrypted file. Neither the document nor the password ever leaves your browser.
❗ Important
Think about what an online "protect PDF" service actually receives: your confidential document and the password you chose for it, together, in one request. That's the whole reason this runs client-side.
🔑 Two different passwords — and only one of them is real security
Every PDF supports two, they do completely different things, and confusing them is the commonest mistake here.
| User password (open password) | Owner password (permissions password) | |
|---|---|---|
| Needed to | Open the file at all | Change the restrictions |
| Content encrypted? | ✅ Yes — the bytes are unreadable without it | ⚠️ Content is encrypted with a known empty user password |
| Blocks reading | ✅ Yes | ❌ No — the file opens freely |
| Blocks printing / copying | Via permissions, once open | Supposed to — but only advisory |
| Enforced by | Cryptography | The honour system of the PDF reader |
⚠️ Warning
Permissions are advisory. "Do not allow printing" and "do not allow copying" are flags in the file that a well-behaved reader chooses to respect. Plenty of readers and libraries simply ignore them, and there is no cryptography stopping them. If content must not be extracted, an owner password will not achieve that.
Only the user password provides actual protection. If it matters, set a user password.
And the password is the whole security
Encryption strength is irrelevant if the password is invoice2024. The file's protection is exactly as strong as the password, and an attacker with the file can guess offline at whatever rate their hardware allows — no rate limiting, no lockout.
Use the password generator for something with real entropy, and — this matters — send the password through a different channel than the file. Emailing an encrypted PDF and its password in the same thread protects you from nothing at all.
🧭 How it works
✨ What's inside
| ### 🔐 Real encryption, done locally The PDF is genuinely encrypted in your browser. No upload means no window where your document and its password sit together on someone else's machine. | ### 🎛️ Permission flags Set print, copy and edit restrictions — with an honest note that readers may ignore them, which most tools won't tell you. |
| ### 🔑 Both password types explained Choose deliberately between "can't open" and "can open but restricted", instead of picking whichever box appeared first. | ### 🚫 Nothing stored No account, no history of protected files, no copy of your password anywhere. |
🛠️ Real jobs
| Situation | Which password |
|---|---|
| 🏦 Emailing a bank statement | User password — must not open without it |
| 📄 Sending an offer letter | User password, shared over a different channel |
| 🧾 Invoice to a client | Usually none; owner password at most |
| 📚 Paid course material | User password per buyer (accepting that it can be shared onward) |
| 🏥 Medical records | User password, strong, out-of-band |
| 💾 Archiving something sensitive | User password, stored in your password manager |
📖 Four steps
1. Open → tooladda.online/pdf-password-protector.html
2. Drop → your PDF
3. Set → a USER password (strong, from a generator)
4. Send → the file one way, the password another way
▶ Protect now — tooladda.online/pdf-password-protector.html
⚠️ Warning
Save the password before you close the tab. There is no recovery, no reset link, and no support desk that can open the file for you — that's what encryption means. Keep an unencrypted original somewhere safe, or store the password in a manager.
❓ FAQ
Is it free?
Free, no signup, no watermark, no file-size limit beyond your device's memory.
Is my file or password uploaded?
Neither. Both stay in your browser — the only safe arrangement for this particular operation.
User password or owner password?
User password if the content must be protected. An owner password only sets advisory restrictions and doesn't stop anyone reading the file.
Can "disable printing" be bypassed?
Yes. Permissions rely on the reader choosing to honour them, and many don't. Only the user password is enforced cryptographically.
I forgot the password. Can you recover it?
No. Nobody can. Keep an unencrypted original and store the password in a manager.
How do I remove protection later?
With the password remover — using the correct password. It's a remover, not a cracker.
🔬 Under the hood
- PDF encryption applied client-side in vanilla JavaScript; no upload endpoint exists.
- Both user and owner passwords supported, with permission flags settable independently.
- Nothing persisted: no history, no localStorage of passwords.
- Works offline once loaded.
Originally published on ToolAdda, where Protect PDF runs free in your browser — nothing is uploaded, nothing leaves your device.
Top comments (0)